![]() |
![]() |
������� | ������������ | ����� | ������ | �������� | |
| ���� | ��������� | ������ | �������� ����� | ����� | |||
|
�������
|
|||
������������ DrWeb ��� ��������� Sendmail �� Linux(n) �������� �������, ���, 2002 ������� ����:
������������ �� ������������ ������������ �������� [root@mailer wrk]# rpm -i drweb-4.29.2-glibc.2.2.i386.rpm � ��������� ��������: /opt/drweb - ������� ����
/etc/drweb - ����� �����������
/etc/rc.d/init.d/drwebd - ��������� ������
/var/drweb - ������ ����
!!! RTFM - ��� �� ������ ��������� !!! [root@mailer wrk]# ln -s /etc/drweb /opt/drweb
��������� ����������� [root@mailer wrk]# useradd -d /dev/null -s /bin/false drweb
[root@mailer wrk]# cat /etc/passwd | grep drweb
drweb:x:547:547::/dev/null:/bin/false
[root@mailer drweb]# chown -R drweb.drweb /opt/drweb
[root@mailer drweb]# chown -R drweb.drweb /var/drweb���������� �� �����: [root@mailer wrk]# cd /opt/drweb
[root@mailer drweb]# ./drweb
Dr.Web (R) for Linux, version 4.29.2 (November 5, 2002)
Copyright (c) Igor Daniloff, 1992-2002
Daniloff's Labs and DialogueScience
http://www.drweb.ru, [email protected]: +7 (812) 387-64-08
http://www.dials.ru, [email protected]: +7 (095) 137-01-50
Key file: /opt/drweb/drweb.key
Registration info:
0100005167
Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
This is an EVALUATION version with limited functionality!
To get your registration key, call regional dealer.
Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 31578���� ���� ����� �����: Key file: /opt/drweb/drweb.key
Registration info:
XXXXXXXXXX������� � �������� � ������������ ������ ���� ���� ������ �����: Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 31578
������� � �������� � ������� ����������� ����������: �� ��������
䳿 ����������� � ������� ������. ��� ���������� ����� ����
��������������� ������. ��� �������� ������ �����
������������ ����������� �������� ������������. ³� �������� (�
��������) � ���� [root@mailer drweb]# cat doc/readme.eicar | grep X5O! >virtest � ���� ��������� ��������������: [root@mailer drweb]# ./drweb virtest
Dr.Web (R) for Linux, version 4.29.2 (November 5, 2002)
Copyright (c) Igor Daniloff, 1992-2002
Daniloff's Labs and DialogueScience
http://www.drweb.ru, [email protected]: +7 (812) 387-64-08
http://www.dials.ru, [email protected]: +7 (095) 137-01-50
Key file: /opt/drweb/drweb.key
Registration info:
0100005167
Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
This is an EVALUATION version with limited functionality!
To get your registration key, call regional dealer.
Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 31578
/opt/drweb/virtest infected with EICAR Test File (NOT a Virus!)
Scan report for "/opt/drweb/virtest":
Scanned : 1 Cured : 0
Infected : 1 Deleted : 0
Modifications : 0 Renamed : 0
Suspicious : 0 Moved : 0
Scan time : 00:00:00 Scan speed : 1 Kb/s
�� �� ����������� ������������� � ����
ϳ�������� ������������ ���������
� ������ -->--------------------------------------<-- --- drweb32.ini.orig Tue Nov 5 00:44:48 2002 +++ drweb32.ini Tue Nov 12 12:46:13 2002 @@ -18,6 +18,9 @@ InfectedFiles = Report SuspiciousFiles = Report IncurableFiles = Report +ActionInfectedArchive = move +ActionInfectedMail = move +ActionInfectedContainer = move ExcludePaths = LogToFile = Yes OverwriteLog = No -->--------------------------------------<--
����������: ��� ������������ �������� �����
�������� �� ���, ���� ������ �������� �������� ����� �
���������. ����������� ������� ��������� �������� �����������
( �� � ������ -->--------------------------------------<-- --- drweb32.ini.orig Tue Nov 5 00:44:48 2002 +++ drweb32.ini Tue Nov 12 12:46:13 2002 @@ -68,10 +71,12 @@ LogPacked = Yes Interfaces = "localhost" ;User = drweb -;UserID = -;GroupID = +UserID = 547 +GroupID = 547 ScanFiles = All MaxCompressionRatio = 20 +MaxFileSizeToExtract = 5000 MaxChildren = 16 SyslogFacility = "Daemon" SyslogPriority = "Alert" -->--------------------------------------<--
����������: � �� ��������������
������������ �����, �����, �������� �������������� ���������������: -->--------------------------------------<-- --- drweb32.ini.orig Tue Nov 5 00:44:48 2002 +++ drweb32.ini Tue Nov 12 12:46:13 2002 @@ -79,6 +84,11 @@ FilterRule X-Mailer ".*Mass.*Sender.*" Reject FilterRule To ".*undisclosed.*recipient.*" Reject FilterRule Subject ".*free.*xxx.*" Reject +FilterRule Subject ".*viagra.*" Reject +FilterRule Subject ".*pennis.*" Reject +FilterRule Subject ".*money.*" Reject +FilterRule From ".*Sarah.*Williams.*" Reject UpdatePath = "/opt/drweb/updates" -->--------------------------------------<-- ������ ������ ���������. ������������ ��������� ��������: [root@mailer drweb]# /etc/rc.d/init.d/drwebd start
Starting Dr. Web daemon...Dr.Web (R) daemon for Linux, version 4.29.2 (November 5, 2002)
Copyright (c) Igor Daniloff, 1992-2002
Daniloff's Labs and DialogueScience
http://www.drweb.ru, [email protected]: +7 (812) 387-64-08
http://www.dials.ru, [email protected]: +7 (095) 137-01-50
Key file: /opt/drweb/drwebd.key
Registration info:
0100005168
Evaluation Key (ID Anti-Virus Lab. Ltd, St.Petersburg)
This is an EVALUATION version with limited functionality!
To get your registration key, call regional dealer.
Loading /var/drweb/bases/drwebase.vdb - Ok, virus records: 31578
Daemon is installed, TCP socket created on port 3000
� ��� ����������� ������� ����� ������� �������
������ ( [root@mailer drweb]# netstat -napl | grep drweb
tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN 6697/drwebd
unix 2 [ ] DGRAM 348573 6697/drwebd ���������� ���� ������: [root@mailer drweb]# clients/drwebdc -fvirtest
Results: daemon return code 0x10020 (known virus is found)�� ������, �����, ���'����� ������ ������� ��������� ����������� ���. ����������� ���������
����������� ���, ��� ���������� �� ��������� �������
����� ���������� ���� � ������ ������������: [root@mailer drweb]# cd ~/wrk
[root@mailer wrk]# rpm -i perl-String-CRC32-1.2-15.i386.rpm��� � ������: [root@mailer drweb]# cd ~/wrk
[root@mailer wrk]# tar xzvf String-CRC32-1.2.tar.gz
String-CRC32-1.2/
...
String-CRC32-1.2/CRC32.pod
[root@mailer wrk]# cd String-CRC32-1.2
[root@mailer String-CRC32-1.2]# perl Makefile.PL INSTALLDIRS=vendor
Checking if your kit is complete...
Looks good
Writing Makefile for String::CRC32
[root@mailer String-CRC32-1.2]# make && make test
cp CRC32.pm blib/lib/String/CRC32.pm
...
All tests successful.
Files=1, Tests=27, 0 wallclock secs ( 0.08 cusr + 0.01 csys = 0.09 CPU)
[root@mailer String-CRC32-1.2]# make install UNINST=1
Installing /usr/lib/perl5/vendor_perl/5.6.1/i386-linux/auto/String/CRC32/CRC32.so
...
Appending installation info to /usr/lib/perl5/5.6.1/i386-linux/perllocal.pod
����������: ���������� ����������� ��� ���������: [root@mailer wrk]# su drweb -s /bin/sh -c /opt/drweb/update/update.pl
[root@mailer wrk]# ll /var/drweb/bases
mtotal 700
-rw-r--r-- 1 drweb drweb 7853 ��� 30 18:45 drw42901.vdb
-rw-r--r-- 1 drweb drweb 5130 ��� 3 23:45 drw42902.vdb
-rw-r--r-- 1 drweb drweb 3994 ��� 10 23:00 drw42903.vdb
-rw-r--r-- 1 drweb drweb 12475 ��� 21 00:38 drw42904.vdb
-rw-r--r-- 1 drweb drweb 8130 ��� 24 23:40 drw42905.vdb
-rw-r--r-- 1 drweb drweb 7564 ��� 1 23:06 drw42906.vdb
-rw-r--r-- 1 drweb drweb 5568 ��� 8 22:35 drw42907.vdb
-rw-r--r-- 1 drweb drweb 644617 ��� 5 00:44 drwebase.vdb
-rw-r--r-- 1 drweb drweb 1794 ��� 11 08:35 drwtoday.vdb
[root@mailer wrk]# ll /opt/drweb/updates
total 28
-rw-r--r-- 1 drweb drweb 2318 ��� 4 00:32 drw42902.txt
-rw-r--r-- 1 drweb drweb 1601 ��� 10 23:28 drw42903.txt
-rw-r--r-- 1 drweb drweb 6064 ��� 18 11:42 drw42904.txt
-rw-r--r-- 1 drweb drweb 2880 ��� 24 23:40 drw42905.txt
-rw-r--r-- 1 drweb drweb 3279 ��� 1 23:06 drw42906.txt
-rw-r--r-- 1 drweb drweb 1398 ��� 8 23:07 drw42907.txt
����������� ��������� ��������� �� ���������
������� -->--------------------------------------<-- #!/bin/sh su drweb -s /bin/sh -c /opt/drweb/update/update.pl -->--------------------------------------<-- ����� ������� �볺��� ��� sendmail. ��� ���� ������ ������� ��������
���������� ��������� ���������� ������ �� ������ �������� � �����: [root@mailer wrk]# rpm -ql sendmail-devel | grep milter
/usr/include/libmilter/mfapi.h
/usr/lib/libmilter.a������� �볺���: [root@mailer wrk]# tar xzvf drweb-clients-4.29-sources.tar.gz
drweb-clients-4.29-sources/
drweb-clients-4.29-sources/addons/
...
drweb-clients-4.29-sources/etc/smb_spider.conf
[root@mailer wrk]# cd drweb-clients-4.29-sources
[root@mailer drweb-clients-4.29-sources]# ln -s /usr/lib/libmilter.a lib/libmilter.a
[root@mailer drweb-clients-4.29-sources]# ln -s /usr/lib/libsmutil.a lib/libsmutil.a
[root@mailer drweb-clients-4.29-sources]# ln -s /usr/include/libmilter include
[root@mailer drweb-clients-4.29-sources]# ./configure
Do you want compile Sendmail filter ? [y or n]
[default=y]:y
Do you use Sendmail version 8.11 ? [y or n]
[default=n]:y
...
Do you want compile commandline client ? [y or n]
[default=y]:y
...
Enter compiler flags
[default=-O2 -Wall -pipe]:
----------------------
Configuration Summary:
OS type = Linux
Milter version = FFR
Milter include dir = include/libmilter
Sendmail util library = lib/libsmutil.a (-lsmutil)
Compiler flag(s) = -O2 -Wall -pipe
Configuration is okey ? [y or n]
[default=y]:y
Creating Makefile ... [.] [src]Done.
[root@mailer drweb-clients-4.29-sources]# make
gcc -c -O2 -Wall -pipe -D__UNIX_DW -DLinux_DW -I./include...
...
gcc dw_md5.o dw_users.o dwsm_dfork.o dwsm_opt.o dwsm_file.o...������� �볺��� � �������� �������: [root@mailer drweb-clients-4.29-sources]# strip drweb-smf
[root@mailer drweb-clients-4.29-sources]# strip drwebdc
[root@mailer drweb-clients-4.29-sources]# cp drweb-smf /opt/drweb
[root@mailer drweb-clients-4.29-sources]# cp drwebdc /opt/drweb� ��� ��� ������������ � ������� ������������: [root@mailer drweb-clients-4.29-sources]# cp etc/drweb_smf.conf /etc/drweb
[root@mailer drweb-clients-4.29-sources]# cp -R templates /etc/drweb
[root@mailer drweb-clients-4.29-sources]# cd ..
����������� ���� ���������� ����������� �볺���: -->--------------------------------------<-- --- drweb_smf.conf.orig Wed Dec 11 16:53:23 2002 +++ drweb_smf.conf Wed Dec 11 16:59:19 2002 @@ -50,7 +50,7 @@ LocalScan = yes # Enable or disable spam-filter (on/off) -SpamFilter = off +SpamFilter = on # User account used by filter FilterAccount = drweb @@ -95,7 +95,7 @@ # pass - pass such messages # discard - discard such messages # reject - reject such message -SpamFilterAlert = pass +SpamFilterAlert = reject # EmptyFrom - mean that SMTP session initiated with empty envelope From: # used for mail notifications (reports) and by spammers @@ -108,7 +108,8 @@ # # discard - discard such messages # reject - reject such message -EmptyFrom = continue +#EmptyFrom = continue +EmptyFrom = reject # SkipObject - mean that daemon found object that cannot be checked: # password protected archive, broken archive, sym-link, @@ -147,10 +148,10 @@ ProcessingErrors = reject # Admin mail address (may be unix-local address) -AdminMail = [email protected] +AdminMail = [email protected] # Filter address, that be used in From: -FilterMail = [email protected] +FilterMail = [email protected] # Quarantine directory. # The infected files could be moved in that dir @@ -176,7 +177,8 @@ # Text string used for generate notification hashes, # used only if FastNotify = Yes # PLEASE EDIT - !!! SECURITY CRITICAL !!! -NotifyHashSalt = !!!___EDIT_THIS___!!! +#NotifyHashSalt = !!!___EDIT_THIS___!!! +NotifyHashSalt = !!! ���� �������� !!! [VirusNotifications] # Enable or disable sending notifications to the persons (yes/no) @@ -185,32 +187,32 @@ RcptsNotify = yes # Files with notification templates -AdminTemplate = /etc/drweb/templates/en-ru/sendmail/virus-admin.msg -SenderTemplate = /etc/drweb/templates/en-ru/sendmail/virus-sender.msg -RcptsTemplate = /etc/drweb/templates/en-ru/sendmail/virus-rcpts.msg +AdminTemplate = /etc/drweb/templates/uk-en/sendmail/virus-admin.msg +SenderTemplate = /etc/drweb/templates/uk-en/sendmail/virus-sender.msg +RcptsTemplate = /etc/drweb/templates/uk-en/sendmail/virus-rcpts.msg [SkipNotifications] AdminNotify = no SenderNotify = yes RcptsNotify = no AdminTemplate = -SenderTemplate = /etc/drweb/templates/en-ru/sendmail/skip-sender.msg +SenderTemplate = /etc/drweb/templates/uk-en/sendmail/skip-sender.msg RcptsTemplate = [MailbombNotifications] AdminNotify = yes SenderNotify = yes RcptsNotify = no -AdminTemplate = /etc/drweb/templates/en-ru/sendmail/mailbomb-admin.msg -SenderTemplate = /etc/drweb/templates/en-ru/sendmail/mailbomb-sender.msg +AdminTemplate = /etc/drweb/templates/uk-en/sendmail/mailbomb-admin.msg +SenderTemplate = /etc/drweb/templates/uk-en/sendmail/mailbomb-sender.msg RcptsTemplate = [ErrorNotifications] AdminNotify = yes SenderNotify = yes RcptsNotify = no -AdminTemplate = /etc/drweb/templates/en-ru/sendmail/error-admin.msg -SenderTemplate = /etc/drweb/templates/en-ru/sendmail/error-sender.msg +AdminTemplate = /etc/drweb/templates/uk-en/sendmail/error-admin.msg +SenderTemplate = /etc/drweb/templates/uk-en/sendmail/error-sender.msg RcptsTemplate = ################### -->--------------------------------------<--
��� ���������� �볺��� ��������� ��������� ������
-->--------------------------------------<--
#!/bin/sh
#
# $Id: template.initscript,v 1.8 2002/05/15 16:41:27 cvser Exp $
#
# description: Dr.Web for Sendmail is a antivirus filter
# for e-mails that comes thru SMTP protocol
#
# chkconfig: 2345 79 31
# processname: drweb-smf
# Use these if cannot found functions
dw_daemon() {
ulimit -c 0
$*
return $?
}
dw_killproc() {
killall $2 $1 >/dev/null 2>&1
return $?
}
dw_status() {
killall -0 $1 >/dev/null 2>&1
if [ $? -eq 0 ] ; then
echo "$1 is running..."
return 0
else
echo "$1 is not running."
return 1
fi
}
# Source function library.
if [ -f /etc/rc.d/init.d/functions ] ; then
. /etc/rc.d/init.d/functions
PROC_DAEMON="daemon"
PROC_KILL="killproc"
PROC_STATUS="status"
MSG_START="Starting drweb for sendmail: "
MSG_RELOAD="Reload drweb for sendmail: "
MSG_STOP="Shutdowning drweb for sendmail: "
MSG_WAIT="Wait for shutdown drweb for sendmail: "
else
PROC_DAEMON="dw_daemon"
PROC_KILL="dw_killproc"
PROC_STATUS="dw_status"
MSG_START=" drweb-sendmail"
MSG_RELOAD="Reload drweb-sendmail"
MSG_STOP=" drweb-sendmail"
MSG_WAIT=" drweb-sendmail(wait)"
fi
if [ ! -f "/opt/drweb/drweb-smf" ] ; then
echo "DrWeb Sendmail Filter not found"
return 1
fi
RETVAL=0
FILTER_UNIX="no"
FILTER_SOCKET=
start() {
# Start daemons.
echo -n $MSG_START
[ "x$FILTER_UNIX" = "xyes" ] && rm -f $FILTER_SOCKET
$PROC_DAEMON /opt/drweb/drweb-smf
RETVAL=$?
echo
return $RETVAL
}
stop() {
# Stop daemons.
echo -n $MSG_STOP
$PROC_KILL drweb-smf
RETVAL=$?
if [ $RETVAL -eq 0 ] ; then
if [ "x$FILTER_UNIX" = "xyes" ] ; then
RETRY=3
while [ -f $FILTER_SOCKET -a $RETRY -gt 0 ] ; do
if [ $RETRY -lt 3 ] ; then
echo
echo $MSG_WAIT
fi
sleep 1
RETRY=$(($RETRY-1))
done
if [ -f $FILTER_SOCKET ] ; then
RETVAL=70
fi
else
# Cannot check inet socket
# For future: use pidfile
sleep 3
fi
fi
echo
return $RETVAL
}
# See how we were called.
case "$1" in
start)
start
RETVAL=$?
;;
stop)
stop
RETVAL=$?
;;
restart)
stop
start
RETVAL=$?
;;
status)
$PROC_STATUS drweb-smf
RETVAL=$?
;;
*)
echo "Usage: $0 { start | stop | restart | status }"
exit 1
esac
exit $RETVAL
-->--------------------------------------<--�� ��������� � ��������� ����: [root@mailer wrk]# chkconfig --add drweb-sendmail
[root@mailer wrk]# chkconfig --list drweb-sendmail
drweb-sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@mailer wrk]# /etc/rc.d/init.d/drweb-sendmail start
��� ���������� �볺��� �� sendmail ������
�������� � -->--------------------------------------<-- --- sendmail.mc.old Mon Jun 10 00:00:00 2002 +++ sendmail.mc Wed Dec 11 16:39:21 2002 @@ -60,3 +60,7 @@ MAILER(smtp)dnl MAILER(procmail)dnl Cwlocalhost.localdomain +define(`_FFR_MILTER',1)dnl +MAIL_FILTER(`drweb-filter',`S=inet:[email protected],F=T,T=S:5m;R:5m;E:1h')dnl +define(`confINPUT_MAIL_FILTERS', `drweb-filter')dnl +dnl define(`confMILTER_LOG_LEVEL', `1')dnl -->--------------------------------------<--
�� ���������� ����� [root@mailer wrk]# m4 /etc/mail/sendmail.mc /etc/sendmail.cf ������������� sendmail: [root@mailer wrk]# /etc/rc.d/init.d/sendmail restart
|
|
|||||
| © 2000-2003, ���, ������� �������� -- ���� �� ����������, �������� ����������� -- ����� ������, ��i���� -- 08.06.2003 14:29:35 | |||||